CVE-2021-34551

Description

PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.

How to fix CVE-2021-34551

To remediate CVE-2021-34551, upgrade the affected package to a fixed version below.

• Bitnami/phpmailer—upgrade to 6.5.0 or later
• Packagist/phpmailer/phpmailer—upgrade to 6.5.0 or later

Is CVE-2021-34551 being exploited?

Low — EPSS is 2.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 6.5.0
• from 0, < 6.5.0

CVSS scores

References (10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-34551
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/phpmailer/phpmailer/CVE-2021-34551.yaml
• WEBgithub.com/PHPMailer/PHPMailer/blob/master/SECURITY.md
• WEBgithub.com/PHPMailer/PHPMailer/commit/acd264bf17ff4ac5c915f0d4226dce8a9ea70bc3